healer | bfdaf35488a7a7abc7c589c2081f34e5fab0f9b8301f5a97fa40e002255aee18

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2024 20:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bfdaf35488a7a7abc7c589c2081f34e5fab0f9b8301f5a97fa40e002255aee18.exe
Size

660KB
MD5

c681d3f343ffcdc71b99172e899de3b9
SHA1

df82a4626e11af352f70965a13efe6005b3413da
SHA256

bfdaf35488a7a7abc7c589c2081f34e5fab0f9b8301f5a97fa40e002255aee18
SHA512

104bf4a3e7950c675363f586e2befe159fb5b0c38de77469d71b8fafc22b153fc9e850f43033808da9d35c02d7b6f4ddbeae94ab21b447ccd73d7e6ae2bcab7e
SSDEEP

12288:+Mrhy90BjyfXCuMWoogUvJA66ZG9CYubbdZztAg9Be:ry96uMOgy6RAwbPztAgG

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1480-19-0x00000000023F0000-0x000000000240A000-memory.dmp	healer
behavioral1/memory/1480-21-0x0000000002620000-0x0000000002638000-memory.dmp	healer
behavioral1/memory/1480-49-0x0000000002620000-0x0000000002632000-memory.dmp	healer
behavioral1/memory/1480-48-0x0000000002620000-0x0000000002632000-memory.dmp	healer
behavioral1/memory/1480-45-0x0000000002620000-0x0000000002632000-memory.dmp	healer
behavioral1/memory/1480-43-0x0000000002620000-0x0000000002632000-memory.dmp	healer
behavioral1/memory/1480-41-0x0000000002620000-0x0000000002632000-memory.dmp	healer
behavioral1/memory/1480-39-0x0000000002620000-0x0000000002632000-memory.dmp	healer
behavioral1/memory/1480-38-0x0000000002620000-0x0000000002632000-memory.dmp	healer
behavioral1/memory/1480-35-0x0000000002620000-0x0000000002632000-memory.dmp	healer
behavioral1/memory/1480-33-0x0000000002620000-0x0000000002632000-memory.dmp	healer
behavioral1/memory/1480-31-0x0000000002620000-0x0000000002632000-memory.dmp	healer
behavioral1/memory/1480-29-0x0000000002620000-0x0000000002632000-memory.dmp	healer
behavioral1/memory/1480-27-0x0000000002620000-0x0000000002632000-memory.dmp	healer
behavioral1/memory/1480-25-0x0000000002620000-0x0000000002632000-memory.dmp	healer
behavioral1/memory/1480-23-0x0000000002620000-0x0000000002632000-memory.dmp	healer
behavioral1/memory/1480-22-0x0000000002620000-0x0000000002632000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

pro3855.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro3855.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro3855.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro3855.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro3855.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro3855.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro3855.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3288-61-0x0000000002410000-0x0000000002456000-memory.dmp	family_redline
behavioral1/memory/3288-62-0x0000000004AA0000-0x0000000004AE4000-memory.dmp	family_redline
behavioral1/memory/3288-68-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/3288-74-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/3288-96-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/3288-94-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/3288-92-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/3288-90-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/3288-88-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/3288-86-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/3288-84-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/3288-82-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/3288-80-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/3288-76-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/3288-72-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/3288-70-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/3288-78-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/3288-66-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/3288-64-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/3288-63-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 3 IoCs

Processes:

un121614.exepro3855.exequ4075.exe

pid process

2628 un121614.exe
1480 pro3855.exe
3288 qu4075.exe

pid	process
2628	un121614.exe
1480	pro3855.exe
3288	qu4075.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

pro3855.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro3855.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro3855.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

bfdaf35488a7a7abc7c589c2081f34e5fab0f9b8301f5a97fa40e002255aee18.exeun121614.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	bfdaf35488a7a7abc7c589c2081f34e5fab0f9b8301f5a97fa40e002255aee18.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un121614.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2112 1480 WerFault.exe pro3855.exe

pid	pid_target	process	target process
2112	1480	WerFault.exe	pro3855.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

bfdaf35488a7a7abc7c589c2081f34e5fab0f9b8301f5a97fa40e002255aee18.exeun121614.exepro3855.exequ4075.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bfdaf35488a7a7abc7c589c2081f34e5fab0f9b8301f5a97fa40e002255aee18.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un121614.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro3855.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu4075.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

pro3855.exe

pid process

1480 pro3855.exe
1480 pro3855.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

pro3855.exequ4075.exe

description pid process

Token: SeDebugPrivilege 1480 pro3855.exe
Token: SeDebugPrivilege 3288 qu4075.exe

pid	process
1480	pro3855.exe
1480	pro3855.exe

description	pid	process
Token: SeDebugPrivilege	1480	pro3855.exe
Token: SeDebugPrivilege	3288	qu4075.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

bfdaf35488a7a7abc7c589c2081f34e5fab0f9b8301f5a97fa40e002255aee18.exeun121614.exe

description	pid	process	target process
PID 1844 wrote to memory of 2628	1844	bfdaf35488a7a7abc7c589c2081f34e5fab0f9b8301f5a97fa40e002255aee18.exe	un121614.exe
PID 1844 wrote to memory of 2628	1844	bfdaf35488a7a7abc7c589c2081f34e5fab0f9b8301f5a97fa40e002255aee18.exe	un121614.exe
PID 1844 wrote to memory of 2628	1844	bfdaf35488a7a7abc7c589c2081f34e5fab0f9b8301f5a97fa40e002255aee18.exe	un121614.exe
PID 2628 wrote to memory of 1480	2628	un121614.exe	pro3855.exe
PID 2628 wrote to memory of 1480	2628	un121614.exe	pro3855.exe
PID 2628 wrote to memory of 1480	2628	un121614.exe	pro3855.exe
PID 2628 wrote to memory of 3288	2628	un121614.exe	qu4075.exe
PID 2628 wrote to memory of 3288	2628	un121614.exe	qu4075.exe
PID 2628 wrote to memory of 3288	2628	un121614.exe	qu4075.exe

C:\Users\Admin\AppData\Local\Temp\bfdaf35488a7a7abc7c589c2081f34e5fab0f9b8301f5a97fa40e002255aee18.exe
"C:\Users\Admin\AppData\Local\Temp\bfdaf35488a7a7abc7c589c2081f34e5fab0f9b8301f5a97fa40e002255aee18.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1844

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un121614.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un121614.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2628

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3855.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3855.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 1100
4⤵
- Program crash
PID:2112

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4075.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4075.exe
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1480 -ip 1480
1⤵
PID:908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un121614.exe

Filesize
518KB

MD5
d7319bc19b96c2a00855052a2f542e40

SHA1
ee0a8aedf60e81f111b106f8bf3f1621c98f45c1

SHA256
092a71095a5bcc855e11a14dcd517f6a697d2d49e69cec378117975001a8fbeb

SHA512
010b1b4211791cb3278a351d9691e2d959e3680ffbacbc2ebd4aa5ff8ccbf571715ad17746daed5872e622e00c77e90bfc8867d14550ee01d340d849fbdeba8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3855.exe

Filesize
237KB

MD5
7dd2678583403fa6b165ca5990051e9d

SHA1
95e15dddb2baf94ed3ed79c990c7b5526714532d

SHA256
5965acbb39f38149e0039dde430fc9d770c4b65a473e00cb9e30590e22929e67

SHA512
77ad5bd436a124afc281656e78a347209ef34573288b0d37c7a85b3f2df5c262716494a9a16b107bdadaab5c152ca63150bcbb30939638c95b7617eb9da130cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4075.exe

Filesize
295KB

MD5
3a1048fdb498f1f05889fe6e1f17f104

SHA1
6b8c828812d85aee26e7719d96df2cc111032a26

SHA256
5990b4c016f972e1396fb140cf9c3016b7b524592ebed3553024902c9b35149b

SHA512
62589bcdf76d0d659ea893893ed627e08d15f893d8740167d5d138bff7b6866b7025854f7fc1c3d6fd3255ea65e27b3cf269220ca34ae64cf8d02f6da7bf3489

Download Submit
memory/1480-15-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1480-16-0x0000000000720000-0x000000000074D000-memory.dmp

Filesize
180KB

Download
memory/1480-17-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1480-18-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/1480-19-0x00000000023F0000-0x000000000240A000-memory.dmp

Filesize
104KB

Download
memory/1480-20-0x0000000004D80000-0x0000000005324000-memory.dmp

Filesize
5.6MB

Download
memory/1480-21-0x0000000002620000-0x0000000002638000-memory.dmp

Filesize
96KB

Download
memory/1480-49-0x0000000002620000-0x0000000002632000-memory.dmp

Filesize
72KB

Download
memory/1480-48-0x0000000002620000-0x0000000002632000-memory.dmp

Filesize
72KB

Download
memory/1480-45-0x0000000002620000-0x0000000002632000-memory.dmp

Filesize
72KB

Download
memory/1480-43-0x0000000002620000-0x0000000002632000-memory.dmp

Filesize
72KB

Download
memory/1480-41-0x0000000002620000-0x0000000002632000-memory.dmp

Filesize
72KB

Download
memory/1480-39-0x0000000002620000-0x0000000002632000-memory.dmp

Filesize
72KB

Download
memory/1480-38-0x0000000002620000-0x0000000002632000-memory.dmp

Filesize
72KB

Download
memory/1480-35-0x0000000002620000-0x0000000002632000-memory.dmp

Filesize
72KB

Download
memory/1480-33-0x0000000002620000-0x0000000002632000-memory.dmp

Filesize
72KB

Download
memory/1480-31-0x0000000002620000-0x0000000002632000-memory.dmp

Filesize
72KB

Download
memory/1480-29-0x0000000002620000-0x0000000002632000-memory.dmp

Filesize
72KB

Download
memory/1480-27-0x0000000002620000-0x0000000002632000-memory.dmp

Filesize
72KB

Download
memory/1480-25-0x0000000002620000-0x0000000002632000-memory.dmp

Filesize
72KB

Download
memory/1480-23-0x0000000002620000-0x0000000002632000-memory.dmp

Filesize
72KB

Download
memory/1480-22-0x0000000002620000-0x0000000002632000-memory.dmp

Filesize
72KB

Download
memory/1480-50-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/1480-51-0x0000000000720000-0x000000000074D000-memory.dmp

Filesize
180KB

Download
memory/1480-52-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1480-55-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/1480-56-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3288-61-0x0000000002410000-0x0000000002456000-memory.dmp

Filesize
280KB

Download
memory/3288-62-0x0000000004AA0000-0x0000000004AE4000-memory.dmp

Filesize
272KB

Download
memory/3288-68-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/3288-74-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/3288-96-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/3288-94-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/3288-92-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/3288-90-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/3288-88-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/3288-86-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/3288-84-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/3288-82-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/3288-80-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/3288-76-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/3288-72-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/3288-70-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/3288-78-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/3288-66-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/3288-64-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/3288-63-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/3288-969-0x0000000005250000-0x0000000005868000-memory.dmp

Filesize
6.1MB

Download
memory/3288-970-0x0000000005870000-0x000000000597A000-memory.dmp

Filesize
1.0MB

Download
memory/3288-971-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3288-972-0x0000000004C00000-0x0000000004C3C000-memory.dmp

Filesize
240KB

Download
memory/3288-973-0x0000000005A80000-0x0000000005ACC000-memory.dmp

Filesize
304KB

Download